ANS-C01 · Question #44
A network engineer needs to standardize a company's approach to centralizing and managing interface VPC endpoints for private communication with AWS services. The company uses AWS Transit Gateway…
The correct answer is A. In the shared services account, create an interface endpoint for AWS KMS. Modify the interface. Option A is the correct answer because it creates a private hosted zone in the shared services account with an alias record that points to the interface endpoint, and associates the private hosted zone with the spoke VPCs in each AWS account. Disabling the private DNS name of…
Question
A network engineer needs to standardize a company's approach to centralizing and managing interface VPC endpoints for private communication with AWS services. The company uses AWS Transit Gateway for inter-VPC connectivity between AWS accounts through a hub-and-spoke model. The company's network services team must manage all Amazon Route 53 zones and interface endpoints within a shared services AWS account. The company wants to use this centralized model to provide AWS resources with access to AWS Key Management Service (AWS KMS) without sending traffic over the public internet. What should the network engineer do to meet these requirements?
Options
- AIn the shared services account, create an interface endpoint for AWS KMS. Modify the interface
- BIn the shared services account, create an interface endpoint for AWS KMS. Modify the interface
- CIn each spoke AWS account, create an interface endpoint for AWS KMS. Modify each interface
- DIn each spoke AWS account, create an interface endpoint for AWS KMS. Modify each interface
How the community answered
(55 responses)- A62% (34)
- B5% (3)
- C22% (12)
- D11% (6)
Explanation
Option A is the correct answer because it creates a private hosted zone in the shared services account with an alias record that points to the interface endpoint, and associates the private hosted zone with the spoke VPCs in each AWS account. Disabling the private DNS name of the interface endpoint ensures that DNS resolution of the endpoint is restricted to the Amazon Route 53 private hosted zone. This option creates a centralized model for managing interface endpoints and Route 53 zones in a shared services AWS account, which simplifies administration and reduces complexity.
Topics
Community Discussion
No community discussion yet for this question.